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Claims: 

The following listing of claims is presented for the Examiner's convenience as no 
amendments are being made at this time. This listing of claims will replace all prior versions, 
and listings, of claims in the application. 

1. (Original) An access control method, including: 

receiving an initial access request for a service from a data processing apparatus; 

sending unique identification data to said apparatus in response to said initial access 
request; and 

applying a rate limit for verifying access to said service until said identification data is 
verified by a user of said apparatus. 

2. (Original) An access control method as claimed in claim 1, wherein verifying said 
identification data corresponds to a first level of access control, and said method includes 
applying at least one additional level of access control following a predetermined number of 
failed attempts to verify said identification data by said user of said apparatus. 

3. (Original) An access control method as claimed in claim 2, wherein said identification 
data is a random unique security code and said apparatus is sent an unique identification number 
which expires if the security code is not verified within a predetermined period of time. 

4. (Original) An access control method as claimed in claim 1, wherein said identification 
data is verified by contacting a device with a known association to said user and said data 
processing apparatus, and having said user provide said identification data using said device. 

5. (Original) An access control method as claimed in claim 1, wherein said identification 
data is verified by said user returning said identification data using communication means having 
a known association to said user and said data processing apparatus. 
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6. (Original) An access control method as claimed in claim 2, wherein said at least one 
additional level includes detecting generation of access requests for said service under control of 
a program instead of under control of said user. 

7. (Previously presented) An access control method as claimed in claim 2, wherein said at 
least one additional level of access control includes sending communication software to said 
apparatus to receive access requests for said service under an additional communication protocol. 

8. (Original) An access control method as claimed in claim 7, wherein said communication 
software encrypts said access requests. 

9. (Original) An access control method as claimed in claim 2, including invoking 
sequentially the levels of access control depending on the number of failed attempts to verify 
said identification data by said user for access requests over predetermined periods of time. 

10. (Previously presented) An access control method as claimed in claim 6, wherein said at 
least one additional level of access control includes sending communication software to said 
apparatus to receive access requests for said service under an additional communication protocol 
and wherein said verifying of said identification data is a first level of access control, said 
detecting is a second level of access control, and said sending of said communication software 
and execution of said additional communication protocol is a third level of access control. 

1 1 . (Original) An access control method as claimed in claim 10, wherein said at least on 
additional level of access control includes a fourth level of access control involving blocking all 
access requests by said data processing apparatus. 

12. (Original) An access control method as claimed in claim 1 1, wherein said blocking 
involves denying all access requests that include address data that corresponds to said data 
processing apparatus. 
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13. (Original) An access control method as claimed in claim 12, wherein the address data is 
an IP address or segment. 

14. (Original) An access control method executed by a computer system, including: 
applying an access rate limit until a user issuing access requests is verified; 

a first control level involving verifying said user; 

a second control level applying hack program detection tests to said access requests and 
verifying said user; 

a third control level requiring use of predetermined download software for transmitting 
said access requests and verifying said user; 

a fourth control level blocking access to said service on the basis of at least one 
communications address corresponding to said access requests; and 

invoking said control levels sequentially depending on a number of failed attempts to 
verify said user. 

15. (Original) An access control method as claimed in claim 14, wherein said user is verified 
by contacting a device with a known association to said user and said data processing apparatus, 
and having said user provide identification data using said device. 

16. (Previously presented) An access control system having components for executing the 
steps of the access control method as claimed in claim 1. 

17. (Previously presented) Access control software stored on a computer system, having 
code for executing the steps of the access control method as claimed in claim 1. 
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18. (Original) An access control system, including: 

an access control server for receiving access requests for a service from a data processing 
apparatus, rate limiting access to the server until a user of said apparatus is verified, and sending 
to said data processing apparatus unique identification data; and 

an IVR for contacting a device having an association with said data processing apparatus, 
issuing a request for said identification data, and providing the data received in response to said 
request to said access server in order to verify said user. 
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